dnsx returns an additional incorrect cname record when requesting multiple record types

[vgdanieltest]

dnsx version:

Tested on 1.0.7/1.1.0

Current Behavior:

dnsx returns an additional incorrect cname record, when requesting multiple record types

Expected Behavior:

dnsx should not return a non existent cname record

Steps To Reproduce:

Expected results:

daniel@Neo:~$ echo developer.dome9.com | ./dnsx -cname -json -silent
{"host":"developer.dome9.com","resolver":["1.0.0.1:53"],"cname":["developer.dome9.com.s3-website-us-east-1.amazonaws.com"],"status_code":"NOERROR","timestamp":"2022-06-12T16:20:57.468407267+03:00"}
daniel@Neo:~$

notice the cname record: "developer.dome9.com.s3-website-us-east-1.amazonaws.com", which is correct.

Now run the same query with an additional record type:

daniel@Neo:~$ echo developer.dome9.com | ./dnsx -cname -a -json -silent
{"host":"developer.dome9.com","resolver":["1.0.0.1:53","8.8.8.8:53"],"a":["52.216.204.26"],"cname":["developer.dome9.com.s3-website-us-east-1.amazonaws.com","s3-website.us-east-1.amazonaws.com"],"status_code":"NOERROR","timestamp":"2022-06-12T16:21:34.424699812+03:00"}
daniel@Neo:~$ 

dnsx now returns an additional cname record, which does not exist: s3-website.us-east-1.amazonaws.com

[ehsandeep]

@vgdanieltest looks like that's what has been configured for the input host, see the dig response, there is CNAME record pointing to s3-website.us-east-1.amazonaws.com

dig developer.dome9.com

; <<>> DiG 9.10.6 <<>> developer.dome9.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14385
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 512
;; QUESTION SECTION:
;developer.dome9.com.		IN	A

;; ANSWER SECTION:
developer.dome9.com.	239	IN	CNAME	developer.dome9.com.s3-website-us-east-1.amazonaws.com.
developer.dome9.com.s3-website-us-east-1.amazonaws.com.	293 IN CNAME s3-website.us-east-1.amazonaws.com.
s3-website.us-east-1.amazonaws.com. 5 IN A	52.216.100.130

;; Query time: 36 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Sun Jun 12 19:52:50 IST 2022
;; MSG SIZE  rcvd: 164

[vgdanieltest]

Hi @ehsandeep,

Thank you for the fast response, it's much appreciated.

As you can see, the second CNAME record comes from "further down" the chain:

daniel@Neo:~$ dig -t CNAME developer.dome9.com

; <<>> DiG 9.16.1-Ubuntu <<>> -t CNAME developer.dome9.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 32194
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;developer.dome9.com.		IN	CNAME

;; ANSWER SECTION:
developer.dome9.com.	300	IN	CNAME	developer.dome9.com.s3-website-us-east-1.amazonaws.com.

;; Query time: 71 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun Jun 12 19:19:17 IDT 2022
;; MSG SIZE  rcvd: 113

daniel@Neo:~$ 

s3-website.us-east-1.amazonaws.com is actually the cname record of developer.dome9.com.s3-website-us-east-1.amazonaws.com:

daniel@Neo:~$ dig -t CNAME developer.dome9.com.s3-website-us-east-1.amazonaws.com

; <<>> DiG 9.16.1-Ubuntu <<>> -t CNAME developer.dome9.com.s3-website-us-east-1.amazonaws.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 20460
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;developer.dome9.com.s3-website-us-east-1.amazonaws.com.	IN CNAME

;; ANSWER SECTION:
developer.dome9.com.s3-website-us-east-1.amazonaws.com.	293 IN CNAME s3-website.us-east-1.amazonaws.com.

;; Query time: 63 msec
;; SERVER: 127.0.0.53#53(127.0.0.53)
;; WHEN: Sun Jun 12 19:20:34 IDT 2022
;; MSG SIZE  rcvd: 118

daniel@Neo:~$ 

I don't think this is the expected dnsx behavior and even if it was, there is still a bug, since you have two requests for the same record with different result sets.

[ehsandeep]

@vgdanieltest

since you have two requests for the same record with different result sets.

There are two requests + results because you asked to make 2 DNS queries by using -a and -cname flags together as each flag makes a new DNS request.

You can find the expected result by using:

echo developer.dome9.com | dnsx -cname -json

or

echo developer.dome9.com | dnsx -a -json

but if you are using them altogether, this is expected behavior.

[vgdanieltest]

@ehsandeep
Thank you for the fast response again.

I really don't get why I should expect a different cname result when requesting multiple record types. I'm still checking the same hostname.